Taobao Tuya BK7252UQN68 Bare A9 Cam PCB (SC-10024 v1.0.0) - UART/SPI Flash Backup - OpenBK7252

Random purchase from Taobao https://kr.world.taobao.com/item/661235058111.htm via Superbuy.com



Bare PCB, no cam, no battery, no case. A9 type PCB size and layout. 18 pin camera connector as seen in other A9s. BK7252UQN68. 2 buttons, 2 LED, one single red the other two-tone blue/green

Markings: SC-10024 v1.0.0



TX1 log at 115200 baud:



garbled area wasn't readable at any baud

EF custom read from 0x11000 to end of 4mb from TX2/RX2

standard BK7252 preset read stops at 2mb.

soldered up test pads and used Beken SPI Python program and CH341A demonstrated here https://www.elektroda.com/rtvforum/topic4073760.html#21512355


Pads map as:

Taobao A9 PCB Pads	Tuya Doorbell Pads	CH341A
CE/CEN	CE	D2
SCK	TCK	SCK
CSN	TMS	CS0
SI	TDI	MOSI
SO	TDO	MISO
GND	GND	GND

into SPI Beken SPI mode




NeoProgrammer detects flash - XTX XT25F32B [3.3V] 32 Mbits, 4 Mbytes - SPI ID: 0B4016. Dumps: https://github.com/openshwprojects/FlashDumps/pull/32/files

---

Pairs with Tuya app


Tuya dev info
Query Things Data Model

Device Details

Device Update Info

---

From https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/14322039247

OpenBK7252_Tuya_QIO__7231u_t_c1b0ac146bf0.bin BL boots but no app



OpenBK7252_QIO__7231u_t_c1b0ac146bf0.bin boots into OBK!

---

Forgot to add that, like the doorbell, the OTA mechanism is like the Realteks with OTA1/OTA2 ping-pong.


ty_ipc_lite_sdk

Interesting, is this supposed to be for developers? Maybe we could ask them to also provide SDK?

no idea on target audience. could try contacting seller I suppose, though not sure how that works through Superbuy

seller was not able/willing to supply this SDK. I have tried to programmatically guess possible Tuya download URLs, but no luck.

Added after 1 [hours] 18 [minutes]:

dunno if these are of any use for anything

regarding the camera and OTA

With OpenBK7252_QIO__7231u_t_c1b0ac146bf0.bin combined with OpenBK7252__7231u_t_c1b0ac146bf0.rbl from 0x132000 and flashed as one file from 0x0 we see OTA process on first boot



OTA attempts in the web app and gui methods just give "malloc failed" log.

So, OTA works. That is good, even though SPI flashing is needed to make it work.
Strange thing about malloc failed. Perhaps OTA uses malloc instead of pvPortMalloc?
But when i tried to use it it worked fine (with default A9 bootloader).

Shall I try anything new or anything again?

basic question. If I want to route these out for potential use as GPIOs I should definitely make a point of removing the resistors (and bridge through)?



No good hooking up sensors and things for testing if there will be things in the way to skew results I figure.

Those resistors are between GPIO and pad? Or between GPIO and ground or VDD? What is their value?

Added after 21 [seconds]:

Aren't they a 0 ohm jumpers?

no continuity to ground or vcc. but hang on, this would make a better dev board maybe https://www.elektroda.com/rtvforum/topic4073760.html

And the resistance of the resistor? It may be just a jumper...

green line = continuity

Added after 7 [minutes]:

so if anything, remove all 3 resistors and bridge the two closest to the test pads?

Is this a single lane?

I am confused by this 4.7k resistor.

p.kaczmarek2 wrote:

Is this a single lane?

yes. continuity

And where this trace goes?

But in general, it's better to remove those resistors....